[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Introduction to Cybersecurity for Commercial Satellite Operations:

ated and maintained. | CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10 | CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10 |
|             | PR.IP-3: Configuration change control processes are in place.
| CM-3, 4, 10                                     | CM-3, 4, SA-10                                  |
|             | PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed. | PS 2,3,4,5,6,7, CM-7                            | CM-7                                            |
|             | PR.IP-12: A vulnerability management plan is developed and implemented. | RA-1, RA-3, RA- 5, SI-2                         | RA-1, RA-3, RA-5, SI-2                          |
|             | PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy. | AU Family                                       | AU1, 2, 3, 6, 7, 12, 13, 14, 16                 |
|             | PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities. | AC-3, 8, 9,19                                   | AC-3, CM-7                                      |

Introduction to Cybersecurity for Commercial Satellite Operations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Considerations for Voice Over IP Systems provide? (Part 5)

[Assistant] | | | 4 H.323...................................................................................................................................................26 | 4 H.323...................................................................................................................................................26 | 4 H.323...................................................................................................................................................26 | | 4.1 | H.323 Architecture ....................................................................................................................26 | | | 4.2 | H.235 Security Profiles..............................................................................................................28 | | | 4.2.1 | H.235v2..................................................................................................................................29 | | | 4.2.2 | H.235v3..................................................................................................................................32 | | | 4.2.3 | H.323 Annex J .......................................................................................................................36 | | | 4.2.4 | H.323 Security Issues............................................................................................................36 | | | 4.3 | Encryption Issues and Performance..........................................................................................37 | | | 5 SIP.......................................................................................................................................................39 | 5 SIP.......................................................................................................................................................39 | 5 SIP.......................................................................................................................................................39 | | 5.1 | SIP Architecture.........................................................................................................................39 | | | 5.2 Existing Security Features within the SIP Protocol .................................................................40 | 5.2 Existing Security Features within the SIP Protocol .................................................................40 | 5.2 Existing Security Features within the SIP Protocol .................................................................40 | | 5.2.1 | Authentication of Signaling Data using HTTP Digest Authentication...............................41 | | | 5.2.2 | S/MIME Usage within SIP....................................................................................................41 | | | 5.2.3 | Confidentiality of Media Data..............................................................................................41 | | | 5.2.4 5.2.5 | TLS usage within SIP............................................................................................................42 IPsec usage within | SIP..........................................................................................................42 | | 5.2.6 | Security Enhancements for SIP ............................................................................................42 | | | 6 Gateway | 5.2.7 SIP Security Issues ................................................................................................................44 | Decomposition..................................................................................................................47 | | | 6.1 MGCP........................................................................................................................................47 | | | 6.1.1 | Overview................................................................................................................................47 | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | 6.1.2 | System Architecture...............................................................................................................48 |

Security Considerations for Voice Over IP Systems

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security Architecture Design Process for Health Information Exchanges (HIEs):

HIPAA Security Rule: 45 CFR 164.312(e)(1), Standard: Transmission Security; Implementation Specification: Encryption.

- SP 800-45, Version 2, Guidelines on Electronic Mail Security.
- SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations.
- SP 800-53 Rev. 3, Recommended Security Controls for Federal Information Systems and Organizations, security control family: System and Communications Protection (SC).
- SP 800-58, Security Considerations for Voice Over IP Systems.
- SP 800-77, Guide to IPsec VPNs.
- SP 800-113, Guide to SSL VPNs.

Illustration: Hospital One sends health records to Hospital Two. Hospital One sends the document using previously agreed-upon encryption methods to ensure the confidentiality of the exchanged health records.

Security Architecture Design Process for Health Information Exchanges (HIEs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Advanced Encryption Standard (AES):

9. Implementation Schedule. This Standard became effective on May 26, 2002. 10. Patents. Implementations of the algorithm specified in this Standard may be covered by U.S. and foreign patents. 11. Export Control. Certain cryptographic devices and technical data regarding them are subject to federal export controls. Exports of cryptographic modules implementing this Standard and technical data regarding them must comply with all federal laws and regulations and must be licensed by the Bureau of Industry and Security of the U.S. Department of Commerce. Information about export regulations is available at https://www.bis.doc.gov. 12. Qualifications. NIST will continue to follow developments in the analysis of the AES algorithm. As with its other cryptographic algorithm standards, NIST will formally reevaluate this Standard every five years. In 1997, NIST initiated the Advanced Encryption Standard (AES) development effort [1] and called for the public to submit candidate algorithms for block ciphers. Block ciphers are the foundation for many cryptographic services,  especially those that provide assurance of the confidentiality of data. In 2000, NIST announced the selection of Rijndael [2, 3] for the AES. - [1]  James Nechvatal, Elaine Barker, Lawrence Bassham, William Burr, Morris Dworkin, James Foti, and Edward Roback. Report on the Development of the Advanced Encryption Standard (AES). Journal of Research of NIST (NIST JRES) , May 2001. https://doi.org/10.6028/jres. 106.023. - [2]  Joan Daemen and Vincent Rijmen. AES Proposal: Rijndael Document Version 2. AES Algorithm Submission, September 1999. Available at https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/ documents/aes-development/rijndael-ammended.pdf. - [3]  Joan Daemen and Vincent Rijmen. The Design of Rijndael - The Advanced Encryption Standard (AES), Second Edition . Information Security and Cryptography. Springer, 2020. https://doi.org/10.1007/978-3-662-60769-5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to An Introduction to Privacy Engineering and Risk Management in Federal Systems:

3.2.2 Privacy Risk Characteristics ... 3.2.2. 3.2.2.

An Introduction to Privacy Engineering and Risk Management in Federal Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security Recommendations for Server-based Hypervisor Platforms:

Since VMs are prime sources of threats to the hypervisor, continuous monitoring of the state of VMs and the traffic going in and out of those VMs is necessary for: (a) controlling the type of traffic, (b) intrusion detection and prevention, and (c) detecting viruses and other malware. This function can be accomplished in two ways:

Security Recommendation HY-SR-16: All anti-malware tools (e.g., virus checkers, firewalls, and IDPS) running in the virtualized host should have the capability to perform autonomous signature or reference file updates on a periodic basis. | HY-SR-15   | Solutions for Security Monitoring and security policy enforcement of VMs should be based 'outside of VMs' and should leverage the virtual machine introspection capabilities of the hypervisor. Generally, such solutions involve running a security tool as a Security Virtual Appliance (SVA) in a security-hardened or trusted VM. . | HY-BF4 (VM Lifecycle Management)           |
|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|
| HY-SR-16   | All antimalware tools (virus checkers, firewalls and IDPS) running in the virtualized host should have the capability to perform autonomous signature or reference file updates on a periodic basis. | HY-BF4 (VM Lifecycle Management)           |
| HY-SR-17   | VM configuration management tools should have the capability to compile logs and alert administrators when configuration changes are detected in any VM that is being monitored.

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Measuring the Usability and Security of Permuted Passwords on Mobile Platforms:

11 Cryptography:  The  discipline  that  embodies  principles,  means  and  methods  for  providing  information  security,  including confidentiality, data integrity, non- repudiation, and authenticity. - [1] K. K. Greene, M. A. Gallagher, B. Stanton, and P. Y. Lee, ' I Can ' t Type That!, P@$$w0rd Entry on Mobile Devices, ' in Human Aspects of Information Security, Privacy, and Trust , Lecture Notes in Computer Science 8533, 2014, pp. 160-171. http://dx.doi.org/10.1007/978-3-319-07620-1\_15. - [2] M. Jakobsson and R. Akavipat, ' Rethinking Passwords to Adapt to Constrained Keyboards, ' Mobile Security Technologies 2012 (MoST 2012) , San Francisco, California, United States, May 24, 2012. http://www.mostconf.org/2012/papers/5.pdf [accessed 4/19/2016]. - [3] National Strategy for Trusted Identities in Cyberspace, Enhancing Online choice, Efficiency, Security, and Privacy , 2011. http://purl.fdlp.gov/GPO/gpo7204. - [4] B. Stanton and K. Greene, ' Character strings, memory, and passwords: What a recall study can tell us, ' in Human Aspects of Information Security, Privacy, and Trust , Lecture Notes in Computer Science 8533, 2014, pp. 195-206. http://dx.doi.org/10.1007/978-3-319-07620-1\_18. - [5] International Organization for Standardization, Ergonomic requirements for office work with visual display terminals (VDTs) -- Part 11: Guidance on usability, ISO 9241-11:1998 . - [6] E. Frøkjær, M. Hertzum, and K. Hornbæk, ' Measuring usability: Are effectiveness, efficiency, and satisfaction really correlated? ' in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ' 00) , The Hague, The Netherlands, April 1-6, 2000, pp. 345-352. http://dx.doi.org/10.1145/332040.332455. - [7] A. Adams, and M. A. Sasse, ' Users are not the enemy, ' Communications of the ACM , vol. 42, no. 12 (December 1999), pp 40-46. http://dx.doi.org/10.1145/322796.322806. - [8] D. Florêncio, C. Herley, and P. C.

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII):

tential impact is LOW if the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

3.4.4. 3.4.4. 3.4.4.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1.
| 1.1                                                                                | Authority...................................................................................................................1-1        |                                                                                |
|                                                                                | 1.2                                                                                | Purpose and Scope .................................................................................................1-1                 |                                                                                |
|                                                                                | 1.3                                                                                | Document Structure.................................................................................................1-2                 |                                                                                |
| 2.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Media Protection?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

| Identify, document, and report vulnerabilities that exist on the PNT system and the system that distributes PNT data. Where safe and feasible, include the use of vulnerability scanning on the PNT system, its components, or a representative system. Testing and characterization to assess system vulnerabilities are recommended periodically or when there are changes to the threat model, the organization's reliance on PNT data, or modifications to the PNT equipment. Receiver or system vulnerability testing may include PNT signal simulation to assess susceptibility to disruption or manipulation of the PNT signal. Testing should be conducted in accordance with industry best practices, laws, and regulations as well as within the business continuity constraints defined for the organization. Vulnerabilities for an operational environment may include the susceptibility to atmospheric and scintillation effects on PNT signals, spoofing of unauthenticated signals, or disruptions or manipulations of PNT services. | DHS CISA 4.a DHS GPS CI ICAO 9849 5, 7.13 IEEE 2030.101 4.12, 4.14, 5 NIST SP 800-53 Rev. 5 CA-2, CA-7, CA-8, PM-15, RA-3, RA-5, SA-5, SA-11, SI-2, SI- 4, SI-5 NTP SEC RTCA 229 1.6.2, 2, 2.1.1.1.4, 2.1.1.1.5, 2.4, 2.5 RTCA 356 3.8.1, 3.8.2 USG FRP 1.7.3 |

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

ignatures on Authentication Information |
| DTR-07.03.01.02 | If RSA with PSS padding is used, the parameters field of the AlgorithmIdentifier type shall assert SHA-256 (OID = 2.16.840.1.101.3.4.2.1).
For RSA with PKCS #1 v1.5 padding, the parameters field is populated with NULL. For ECDSA, the parameters field is absent. | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile                     |
| DTR-07.03.01.03 | The subjectPublicKeyInfo field shall assert an algorithm in the AlgorithmIdentifier in accordance with Table 3-4 of [SP800-78]. | • [SP800-78], Section 3.2.2 - Specification of Public Keys In X.509 Certificates                |
| DTR-07.03.01.04 | If the public key algorithm is elliptic curve, then the parameters field contains the namedCurve choice populated with the OID for Curve P-256 (1.2.840.10045.3.1.7). | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile                     |
| DTR-07.03.01.05 | The keyUsage extension shall assert only the digitalSignature bit. No other bits shall be asserted. | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile                     |
| DTR-07.03.01.06 | The policyIdentifier field in the certificatePolicies must assert id-fpki-                                                                                | • [PROF], Worksheet titled - Derived PIV                                                        |

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4):

3.2.3    |
| SER5    | A TPDU with an improper label shall be discarded. 3.2.3 | Local Matter; Audit Advised.

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

enterprise mobility management (EMM); mobile; mobile application vetting (MAV); mobile device management (MDM); mobile security; mobile threat defense (MTD); tablets. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Introduction ...................................................................................................................... | 2                                                                                |
|                                                                                | Purpose......................................................................................................................

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

| Update                                                                                | Description of Update                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Clarified that terms like 'compliance' can be confusing and mean something very different to various Framework stakeholders | Added clarity that the Framework has utility as a structure and language for organizing and expressing compliance with an organization's own cybersecurity requirements. However, the variety of ways in which the Framework can be used by an organization means that phrases like 'compliance with the Framework' can be confusing.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Attribute Considerations for Access Control Systems:

|    | Executive Summary..................................................................................................... | Executive Summary..................................................................................................... | iv   |
|----|----------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|------|
| 1  | Introduction............................................................................................................ | Introduction............................................................................................................

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MP.L2-3.8.3 (NIST 3.8.3)?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

3.8.3, 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

DNS software should not be running or present in hosts that are not designated as name servers. The possibility arises in the case of DNS BIND software because of the fact that many versions of Unix (including Solaris and Linux versions) come installed with BIND as default. Hence, while taking an inventory of software in workstations and servers of the enterprise as part of the security audit, it is necessary to look for BIND installations and remove them from hosts that are not functioning as name servers.

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 5)

[Assistant]
blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. 1                                                                                | Executive Summary................................................................................................................. 1                                   | Executive Summary.................................................................................................................

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

- Intel Control-Flow Enforcement Technology (Intel CET)
- Arm Pointer Authentication Code (PAC)
- Arm Branch Target Identification (BTI)
- IBM ROP and COP/JOP Attack Defenses

A trusted execution environment (TEE) is an area or enclave protected by a system processor. Sensitive secrets like cryptographic keys, authentication strings, or data with intellectual property and privacy concerns can be preserved within a TEE, and operations involving these secrets can be performed within the TEE, thereby eliminating the need to extract the secrets outside of the TEE. A TEE also helps ensure that operations performed within it and the associated data cannot be viewed from outside, not even by privileged software or debuggers. Communication with the TEE is designed to only be possible through designated interfaces, and it is the responsibility of the TEE designer/developer to define these interfaces appropriately. A good TEE interface limits access to the bare minimum required to perform the task. - https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolationwith-integrity-protection-and-more.pdf
- [47] Arm (2022) Arm Architecture Reference Manual for A-profile architecture . Available at https://developer.arm.com/documentation/ddi0487/latest
- [48] Arm (2020) Trusted Base System Architecture for Armv8-A . Available at https://developer.arm.com/documentation/den0021/f/?lang=en
- [49] Arm (2022) TrustZone for AArch64 . Available at https://developer.arm.com/documentation/102418/0100/What-is-TrustZone-?lang=en
- [50] Parsec Project (2022) Parsec. Available at https://github.com/parallaxsecond/parsec
- [51] Parsec Project (2019) Authenticators . Available at https://parallaxsecond.github.io/parsec-book/parsec\_service/authenticators.html
- [52] SPIFFE (2022) SPIFFE Verifiable Identity Document (SVID) . Available at https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/#spiffe-verifiable-identitydocument-svid
- [53] SPIFFE (2022) SPIRE Concepts .

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

Specification of Digital Signatures on Authentication Information..........................................7                                                                                | 3.2.1. Specification of Digital Signatures on Authentication Information..........................................7                                                                                |                                                                                |
|                                                                                | 3.2.2. Specification of Public Keys In X.509 Certificates .....................................................................8                                                                                | 3.2.2. Specification of Public Keys In X.509 Certificates .....................................................................8                                                                                |                                                                                |
|                                                                                | 3.2.3.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

eakdown in security, which is similar to the reuse of a one-time pad. Files of more than 64 GiB are not unusual in video editing and genomics research, but they cannot be encrypted using the GCM mode.
For example, the Cryfa [38][72] tool to encrypt genomic data suggests using the command line tool 'split' to handle files of more than 64 GiB (and the 'cat' command line tool to rejoin the parts after decryption), a cumbersome process that could have been avoided if GCM supported larger plaintexts. NIST's Galois/Counter Mode (GCM) and GMAC Validation System (GCMVS) [48] also contain tests for testing for GCM-AES-XPN, where 'XPN' is an abbreviation of 'eXtended Packet Numbering.' GCM-AES-XPN is used in IEEE 802.1AE, also known as MACsec [41]. The only difference with GCM is that there is an additional salt input, which is XORed with the IV input to create the nonce for GCM. The rationale for the salt input of GCM-AES-XPN is to mitigate the concern that 'counter mode gives an attacker exactly what they want for integral cryptanalysis: a complete set of block cipher inputs that differ only in some bit positions' [54]. This is an incorrect understanding of the security of block cipher modes of operation and of the AES block cipher. The security model assumes that the adversary can query plaintexts of its choosing. However, care must now be taken that no additional vulnerability is introduced by GCM-AES-XPN: rather than ensuring the uniqueness of the nonce, the uniqueness of the XOR of the IV and the salt must be ensured. Similarly, Cryfa shuffles the plaintext before the GCM encryption is applied in an unnecessary attempt to mitigate known-plaintext attacks. Lastly, note that in the multi-key security [56] setting where cryptographic algorithms are used

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems:

|
| Table 1.
Technical cybersecurity capability recommendations...........................................................14                                                                                |
| Table 2. Non-technical cybersecurity capability recommendations....................................................19                                                                                |
| Table 3. Characteristics of tested inverters .......................................................................................28                                                                                |
| Table 4. Guideline #1 testing results .................................................................................................28                                                                                |
| Table 5. Guideline #2 testing results .................................................................................................29                                                                                |
| Table 6. Guideline #3 testing results .................................................................................................29                                                                                |
| Table 7. Guideline #4 testing results .................................................................................................30                                                                                |
| Table 8.

Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to BIOS Protection Guidelines for Servers:

.................................................................. | 1. Introduction....................................................................................................................
| 1-1                                                                                |
| 1.1                                                                                | Purpose and Scope................................................................................................1-1                   |                                                                                |
| 1.2                                                                                | Audience                                                                                | ................................................................................................................1-1                    |
| 1.3                                                                                | Document Structure................................................................................................1-2                  |                                                                                |
| 2. Background.................................................................................................................... 2-1  | 2. Background.................................................................................................................... 2-1  | 2. Background....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Information Security Guide for Government Executives:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) has the broad mission of supporting U.S. industry, government, and academia by promoting U.S. innovation and industrial competitiveness through advancement of information technology measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. ITL researchers have developed detailed protocols and operational standards that improve safety of their operation, and established assessment criteria and test data sets for validation of industrial products. ITL formulates metrics, tests, and tools for a wide range of subjects such as information complexity and comprehension, high confidence software, space-time coordinated mobile and wireless computing, as well as, issues of information quality, integrity, and usability. Under the Federal Information Security Management Act, ITL is directed to develop cyber security standards, guidelines, and associated methods and techniques. ITL responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non national-security-related information in federal information systems. This Interagency Report provides a broad overview of information security program concepts to assist senior leaders in understanding how to oversee and support the development and implementation of information security programs.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Computer Security Division 2004 Annual Report:

e civil service, the senior executive  service, the  military, some  of  the largest  corporations  worldwide, small-  and medium-sized  businesses  and  some  of  the  top universities in the nation.
The members' experience likewise covers a broad spectrum of activities  including  many  different  engineering  disciplines, computer programming, systems analysis, mathematics, management  positions, information  technology  auditing, legal  experience  (two Board  members  are  attorneys), an  extensive history  of  professional  publications  and  professional journalism. Members have worked (and in many cases, are continuing to work in their fulltime jobs) on the development and evolution of some of the most important pieces of information security and privacy in the Federal government, including  the  Privacy  Act  of  1974, the Computer Security Act of 1987, the Federal Public Key  Infrastructure  (PKI)  effort  and  numerous  egovernment services and initiatives.

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Computer security; Cybersecurity Framework (CSF); distributed control systems (DCS); industrial control systems (ICS); information security; manufacturing; network security; programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems

| 1. Introduction ............................................................................................................1                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 Purpose & Scope............................................................................................ 1                                                                                |
| 1.2 Audience......................................................................................................... 2                                                                                |
| 1.3 Document Structure........................................................................................ 2 2.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide for Cybersecurity Event Recovery:

| Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi                                                                                | Executive Summary...................................................................................................................vi   |
|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .........................................................................................................................1 | 1. Introduction .........................................................................................................................1 | 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to LTE Security:

hich components are infected. These types of attacks have been previously observed in GSM networks [22], but as of this time there is no known example of this attack within backend LTE infrastructure.
A Distributed Denial of Service (DDoS) attack against an MME could be launched via a continuous stream of attach requests.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Signature Standard (DSS):

This standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. 3. Explanation : This standard specifies algorithms for applications requiring a digital signature rather than a written signature. A digital signature is represented in a computer as a string of bits and computed using a set of rules and parameters that allow the identity of the signatory and the integrity  of  the  data  to  be  verified. Digital  signatures  may  be  generated  on  both  stored  and transmitted data. 4. Approving Authority: Secretary of Commerce. 5. Maintenance  Agency: Department  of  Commerce,  National  Institute  of  Standards  and Technology, Information Technology Laboratory, Computer Security Division. 6. Applicability: This  standard  is  applicable  to  all  federal  departments  and  agencies  for  the protection of sensitive unclassified information that is not subject to section 2315 of Title 10, United States Code, or section 3502 (2) of Title 44, United States Code. This standard shall be used in designing and implementing public key-based signature systems that federal departments and agencies operate or that are operated for them under contract. The adoption and use of this standard are available to private and commercial organizations. 7. Applications: A digital signature algorithm allows an entity to authenticate the integrity of signed data and the identity of the signatory.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling of Consumer Software:

| 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1    | 1 Introduction ............................................................................................................1   |
|--------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 1.1 Background..................................................................................................... | 1                                                                                |
| 1.2                                                                                | Document Scope and Goals........................................................................... | 1                                                                                |
| 1.3                                                                                | Labeling Schemes and Scheme Owners........................................................

Recommended Criteria for Cybersecurity Labeling of Consumer Software


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

ld allow installation or execution. |
| 3) Gain Foothold            | The attacker has gained entry to the assessment object and achieves enough compromise to gain a foothold, but without persistence.
Examples include: unauthorized user successfully logs in with authorized credentials; browser exploit code successfully executed in memory and initiates call back; person gains unauthorized access to server room. | Block Foothold: Reduce number of devices susceptible to compromise due to unauthorized software being allowed to execute. |
| 4) Gain Persistence         | The attack has gained a foothold on the object and now achieves persistence. Examples include: malware installed on host that survives reboot or log off; basic input/output system (BIOS) or kernel modified; new/privileged account created for unauthorized user; unauthorized person issued credentials/allowed access; unauthorized personnel added to access control list (ACL) for server room. | Block Persistence/Prevent: Stop or delay compromise of devices by restricting software installation. Block Persistence/Detect: Reduce amount of time that malicious or compromised software is installed or remains active before detection and removal. |
| 6) Achieve Attack Objective | The attacker achieves an objective. Loss of confidentiality, integrity, or availability of data or system capability. Examples include: exfiltration of files; modification of database entries; deletion of file or application; denial of service; disclosure of personally identifiable information (PII). | Restore required and authorized software as needed, after being removed or altered by attackers, contingency (disk failure), or by mistake. |

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does User's Guide to Telework and Bring Your Own Device (BYOD) Security provide?

[Assistant]
## NIST Special Publication 800-114 Revision 1

## User's Guide to Telework and Bring Your Own Device (BYOD) Security

Murugiah Souppaya Karen Scarfone

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-114r1

C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-114 Revision 1

## User's Guide to Telework and Bring Your Own Device (BYOD) Security

Murugiah Souppaya Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-114r1

July 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.

User's Guide to Telework and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management:

| Example Enterprise Type   | Example Risk Appetite Statement                                                                                | Example Risk Tolerance Statement                                                                                |
|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Global Retail Firm        | Our customers associate reliability with our company's performance, so service disruptions must be minimized for any customer-facing websites. | Regional managers may permit website outages lasting up to 4 hours for no more than 5 %of its customers. |
| Government Agency         | Mission-critical systems must be protected from known cybersecurity vulnerabilities. | Systems designated as mission-critical must be patched against critical software vulnerabilities (severity score of 10) within 14 days of discovery. |
| Internet Service Provider | The company has a low risk appetite with regard to failure to meet customer service level agreements, including network availability and communication speeds.

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Cryptographic Key Generation:

| Algorithm                | A clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result. |
|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Approved                 | FIPS-approved and/or NIST-recommended. |
| Asymmetric key           | A cryptographic key used with an asymmetric-key (public-key) algorithm. The key may be a private key or a public key. |
| Asymmetric-key algorithm | Acryptographic algorithm that uses two related keys: a public key and a private key. The two keys have the property that determining the private key from the public key is computationally infeasible; also known as a public-key algorithm. |
| Bit string               | An ordered sequence of 0 and 1 bits. |
| Ciphertext               | Data in its encrypted form. |
| Compromise               | The unauthorized disclosure, modification, or use of sensitive data (e.g., keying material and other security-related information). |
| Cryptographic algorithm  | A well-defined computational procedure that takes variable inputs (often including a cryptographic key) and produces an output. |
| Cryptographic boundary   | An explicitly defined continuous perimeter that establishes the physical bounds of a cryptographic module and contains all the hardware, software, and/or firmware components of a cryptographic module. See FIPS 140.

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products:

Cybersecurity utility: Maintaining confidentiality, integrity, and availability of data is foundational to cybersecurity for IoT products. Customers will expect that data is protected and that protection of data helps to ensure safe and intended functionality of the IoT product. Cybersecurity utility: Inventorying and controlling access to all internal and external interfaces to the IoT product will help preserve the confidentiality, integrity, and availability of the IoT product, its components, and data by helping prevent unauthorized access and modification.

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does An Industrial Control System Cybersecurity Performance Testbed provide? (Part 2)

[Assistant] Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director ## Table of Contents | | Introduction ..........................................................................................................................................1 | Introduction ..........................................................................................................................................1 | |---------|------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Testbed Design Approach.....................................................................................................................2 | Testbed Design Approach.....................................................................................................................2 | | 3 | Testbed Design......................................................................................................................................3 | Testbed Design......................................................................................................................................3 | | 3.1 | Tennessee Eastman Process .........................................................................................................3 | Tennessee Eastman Process .........................................................................................................3 | | 3.1.1 | Tennessee Eastman Process: Analog Simulation..................................................................3 | Tennessee Eastman Process: Analog Simulation..................................................................3 | | 3.1.1.1 | Tennessee Eastman Process: C++ Derivative....................................................................5 | Tennessee Eastman Process: C++ Derivative....................................................................5 | | 3.1.2 | Testbed Enclave: Hardware-in-the-Loop Simulator..............................................................5 | Testbed Enclave: Hardware-in-the-Loop Simulator..............................................................5 | | 3.1.2.1 | Logical Architecture ..........................................................................................................5 | Logical Architecture ..........................................................................................................5 | | 3.1.2.2 | Physical Architecture ........................................................................................................7 | Physical Architecture ........................................................................................................7 | | 3.1.2.3 | TE Plant Software Architecture.........................................................................................7 | TE Plant Software Architecture.........................................................................................7 | | 3.1.2.4 | TE Controller Software Architecture.................................................................................8 | TE Controller Software Architecture.................................................................................8 | | 3.1.2.5 | Theory of Operation..........................................................................................................9 | Theory of Operation..........................................................................................................9 | | 3.1.3 | Process Control with Faster Dynamics..................................................................................9 | Process Control with Faster Dynamics..................................................................................9 | | 3.2.1 | Computing Rack Design ......................................................................................................11 | Computing Rack Design ......................................................................................................11 | |

An Industrial Control System Cybersecurity Performance Testbed


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Guidelines for Derived Personal Identity Verification (PIV) Credentials:

3.3.3 of [SP800-73Part1]  except for the following:
- o References to ' keysWithOnCardCerts ' should be interpreted as keys for which the corresponding certificate is populated within the Derived PIV Application.

Guidelines for Derived Personal Identity Verification (PIV) Credentials


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

3.3.1                             | Data Recording                              | 3-13    |
|                                |                                | 3. 3.3.1 Data Recording

Audit data is recorded from several sources (such as the logon host's operating system or a remote application) to produce a complete picture of a user's security relevant actions.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop provide? (Part 2)

[Assistant]
ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This report provides a summary of the discussion and findings from the NIST Cybersecurity Risks in Consumer Home Internet of Things (IoT) Devices virtual workshop in October 2020.

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Program Review for Information Security Management Assistance (PRISMA):

the information security program and the agency's ability to comply with existing requirements in eight areas . The last TA reviews the technical aspects of the overall information security program .
PRISMA therefore provides a framework to assist in instructional purposes as well as to assist assessments, independent evaluations, or reviews.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Storage, computing, and networking form the three fundamental building blocks of an information technology infrastructure. Just like computing and network technologies, storage technology has also evolved over the years. Higher capacity storage media and storage system architecture are the two fronts on which storage technology has evolved.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

durable housing may be needed to withstand excessive heat, cold, and moisture while still providing data availability and integrity. 2. Does the IoT device lack key device cybersecurity requirements?
Key device cybersecurity requirements are those the organization has determined that the IoT device must possess in order for the device to be integrated in the system and make external connections to other systems or the Internet. Lack of key device cybersecurity requirements indicates that the IoT device cannot support existing information system controls, which subsequently introduces unacceptable levels of risk 16 . To support information system security controls, the organization may need to consider if other system elements (e.g., a gateway, hub, cloud service) can provide the capabilities missing from the IoT device but should keep in mind those key device cybersecurity requirements

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Managing the Security of Mobile Devices in the Enterprise provide? (Part 5)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Introduction ......................................................................................................................

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

....................................................................................... | 63                                                                                |
| A.1.1.
C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6. FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Federation and Assertions provide? (Part 2)

[Assistant]
signed statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.
Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does U.S. Department of Energy Risk Assessment Methodology provide? (Part 3)

[Assistant]
fb'-o^\,Txst;;,&

•<^3

V'

-miftitSS

."A :.,,«

'

,

1

. r

i'-

>'

'

-;Oof

y

oj

/

•':

bfi6

>'<r

O':

V 0-r b'Y6ge''

-yy y'r^)T,o3

a y

I.H

..-fcra

-

y;

'r

•

'/i'.
{

;

^

,

^

'

## DEPARTMENT OF ENERGY

<!-- image -->

## VOLUME I

DOE RISK ASSESSMENT GUTOELDVE EVSTRUCTIONS, RESOURCE TABLE, AND COMPLETED SAMPLE

- - A Structured Approach - -

September, 1989

## TABLE OF CONTENTS

|                         |            | Page Number   |    |
|-------------------------|------------|---------------|----|
|                         |            | 1             |    |
| INTRODUCTION            |            |               |    |
| 1 . | Background | 1             |    |
|                         | 2. |               |    |
| Objectives Organization |            | 2             |    |
|                         | 3. | 3             |    |
| 4. |            | 4             |    |
|                         | STEP       |               |    |
|                         |            | 12            |    |
|                         |            | 17 18         |    |
|                         |            | 20            |    |
|                         | R1         |               |    |
|                         | STEP       | 22            |    |
|                         |            | 24            |    |
|                         |            | 26            |    |
|                         |            | 27            |    |
| STEP                    |            |               |    |
|                         |            | 29            |    |
|                         | R3         |               |    |
|                         |            | 34            |    |
| STEP                    |            |               |    |
| 4 REVIEW ANY            |            | 37            |    |
|                         | .

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

There  may  be  references  in  this  publication  to  other  publications  currently  under  development  by  NIST  in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until  each  publication  is  completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.  For  planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of these new publications by NIST.

Federal agencies and their contractors are required to select appropriate [FIPS 199] impact levels for their information and to select security controls from those identified in [SP 80053]  to  use  in  procurements,  implementations  and  planning.  After  selecting  the  applicable security  control(s),  organizations  can  initiate  the  tailoring  process  to  appropriately  modify and align the controls more closely with the specific conditions within the organization (i.e., conditions  related  to  organizational  missions/business  functions,  information  systems,  or environments  of  operation).  This  Profile  addresses  the  selection  of  several  of  the  security controls  specified  in  [SP  800-53],  indicating  the  minimum  requirements  for  those  security

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to BowTie – A deep learning feedforward neural network for sentiment analysis:

Third, what dataset should be used for training? In all cases the size of the training dataset is very important for the quality of training but the way the dataset is constructed and the amount of meta-data it includes also play a role. For example, the Keras IMDB Movie reviews Dataset [10] (KID) for sentiment classification contains human-written movie reviews. A larger dataset of similar type is the Stanford Large Movie Review Dataset (SLMRD) [1]. I consider KID and SLMRD in detail in Sections 1.3 and 1.4. Generally, simpler encodings and models trained on large amounts of data tend to outperform complex systems trained on smaller datasets [13].

Fourth, what kind of training procedure should be employed - supervised or unsupervised? Traditionally, NLP systems are trained on large unsupervised corpora and then applied on new data. However, researchers have been able to leverage the advantages of supervised learning and transfer trained models to new data by retaining the transfer accuracy [4].

Fifth, when training a model for transfer to other datasets, what are the model characterizing features that guarantee maintaining high/comparable transfer accuracy on the new dataset? Certainly, training and validation accuracy are important but so are the training and validation losses. Some researchers argue that the gradient descent method has an implicit bias that is not yet fully understood, especially in cases where there are multiple solutions that properly classify a given dataset [14]. Thus, it is important to have a neural network with low loss estimates for a trained model to hope for a good and reliable transfer accuracy.

BowTie – A deep learning feedforward neural network for sentiment analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendations for Key-Encapsulation Mechanisms:

3.1. Compliance With NIST Standards and Validation . . . . . . . . . . . . . . . .

3.1. Compliance With NIST Standards and Validation

Recommendations for Key-Encapsulation Mechanisms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Seagate Technology:

sk management (CSCRM). Managing risks across a large number of diverse suppliers necessitates a clear, scalable, and defensible foundation. Seagate achieves this by leveraging international standards.
- Internal alignment streamlines incident management. Supply chain incident response requires cross-organizational cooperation. Seagate eliminates friction between disparate functional teams by aligning incident management processes and procedures across all security and risk teams. - Continuous improvement. C-SCRM processes must rapidly incorporate information about new hardware and software vulnerabilities. Seagate leverages open-source intelligence, cross-functional tabletop exercises, and post-incident reporting to improve their incident management practices. - Suppliers welcome C-SCRM support. Many suppliers now recognize the value of robust cybersecurity and supply chain risk management programs. Seagate finds that most suppliers are happy to work together to mature their internal practices.

Case Studies in Cyber Supply Chain Risk Management_ Seagate Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

The information and communications technology (ICT) on which an enterprise relies is managed through a broad set of ICT risk disciplines that include privacy, supply chain, and cybersecurity. ICT includes a broad range of information and technology that extends far beyond traditional information technology considerations. For example, a growing number of enterprises rely on operational technology (OT) and IoT (Internet of Things) devices' sensors or actuators bridging the physical world and the digital world. Increasingly, artificial intelligence (AI) factors into enterprise risk. NIST's AI Risk Management Framework points out that 'AI risk management should be integrated and incorporated into broader enterprise risk management strategies and processes. Treating AI risks along with other critical risks, such as cybersecurity and privacy, will yield a more integrated outcome and organizational efficiencies.' 1

This publication addresses OMB's points above for ensuring that ERM considerations and decisions take an ICT portfolio perspective. This publication examines the relationships among ICT risk disciplines and enterprise risk practices. Notably, OMB has stressed the need for enterprise risk considerations and decisions to be based on a portfolio-wide perspective. Individual risk programs have an important role and must integrate activities as part of that enterprise portfolio. Doing so ensures a focus on achieving enterprise objectives and helps identify those risks that will have the most significant impact on the entity's mission. This publication extends that NIST risk program guidance to recognize that risk extends beyond the boundaries of individual programs. There are extensive ICT risk considerations (e.g., Internet of Things, supply chain, privacy, cybersecurity) as well as risk management frameworks that support the management of a mosaic of interrelated risks.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

| ID                          | Object Identifier    | Description                                                                                |
|-----------------------------|----------------------|-------------------------------------------------------------------------------------------------------------|
| id-PIV- CHUIDSecurityObject | 2.16.840.1.101.3.6.1 | The associated content is the concatenated contents of the CHUID, excluding the asymmetric signature field. |
| id-PIV- biometricObject     | 2.16.840.1.101.3.6.2 | The associated content is the concatenated CBEFF_HEADER + STD_BIOMETRIC_RECORD . |

| ID                  | Object Identifier    | Description                                                                                |
|---------------------|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| pivCardholder- Name | 2.16.840.1.101.3.6.3 | The attribute value is of type DirectoryString and specifies the PIV cardholder's name. |
| pivCardholder-DN    | 2.16.840.1.101.3.6.4 | The attribute value is an X.501 type Name and specifies the DN associated with the PIV cardholder in the PIV certificates.

Personal Identity Verification (PIV) of Federal Employees and Contractors